Cryptographic issues in AMD products - CVE-2021-46744

Vulnerability identifier: #VU63692

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-46744

CWE-ID: CWE-310

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a ciphertext side channel attack where data in specific cryptographic algorithms can be inferred in a SEV guest by monitoring the ciphertext values over time. A local user with access to the hypervisor can gain access to sensitive information, related to the guest OS.

1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
AMD EPYC Embedded Processors
wolfSSL
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Dell EMC NetWorker vProxy
ucode-amd
kernel-firmware
kernel-firmware-media
kernel-firmware-amdgpu
kernel-firmware-marvell
kernel-firmware-liquidio
kernel-firmware-iwlwifi
kernel-firmware-intel
kernel-firmware-i915
kernel-firmware-dpaa2
kernel-firmware-chelsio
kernel-firmware-brcm
kernel-firmware-bnx2
kernel-firmware-bluetooth
kernel-firmware-atheros
kernel-firmware-ath11k
kernel-firmware-ath10k
kernel-firmware-qlogic
kernel-firmware-usb-network
kernel-firmware-ueagle
kernel-firmware-ti
kernel-firmware-sound
kernel-firmware-serial
kernel-firmware-realtek
kernel-firmware-radeon
kernel-firmware-mediatek
kernel-firmware-prestera
kernel-firmware-platform
kernel-firmware-nvidia
kernel-firmware-nfp
kernel-firmware-network
kernel-firmware-mwifiex
kernel-firmware-mellanox
kernel-firmware-all
kernel-firmware-qcom

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

wolfSSL - update to 5.4.0
Dell EMC NetWorker vProxy - update to 4.3.0-32
ucode-amd - addressed in versions 20190618-5.25.2, 20191118-150000.3.42.1, 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware - addressed in versions 20190618-5.25.2, 20191118-150000.3.42.1, 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-media - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-amdgpu - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-marvell - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-liquidio - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-iwlwifi - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-intel - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-i915 - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-dpaa2 - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-chelsio - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-brcm - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-bnx2 - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-bluetooth - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-atheros - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ath11k - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ath10k - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-qlogic - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-usb-network - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ueagle - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ti - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-sound - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-serial - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-realtek - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-radeon - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-mediatek - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-prestera - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-platform - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-nvidia - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-nfp - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-network - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-mwifiex - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-mellanox - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-all - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-qcom - update to 20220509-150400.4.5.1

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1033
• https://www.amd.com/system/files/documents/221404394-a_security_wp_final.pdf

• Ciphertext side channel attack in AMD EPYC processors
• SUSE update for kernel-firmware
• Multiple vulnerabilities in wolfSSL
• Multiple vulnerabilities in Dell EMC NetWorker vProxy
• SUSE update for kernel-firmware
• SUSE update for kernel-firmware
• SUSE update for kernel-firmware